fix: apply rewritten query in agent qa

[wolfkill]

Summary

• Apply custom agent query rewrite before AgentQA executes the ReAct engine, so multi-turn agent calls use the rewritten query instead of the original user query.
• Reuse the existing query-understanding output parser and preserve backward-compatible fallbacks to the original query when rewrite is disabled, misconfigured, fails, or returns an empty result.
• Include image descriptions and attachments in the rewrite prompt context while keeping the existing final agent-query augmentation behavior.

Fixes #1437

Tests

• CGO_LDFLAGS="-lc++" go test ./internal/application/service/chat_pipeline -count=1
• CGO_LDFLAGS="-lc++" go test ./internal/application/service -count=1
• CGO_LDFLAGS="-lc++" go test ./internal/agent/... -count=1

Notes

• CGO_LDFLAGS="-lc++" go test ./internal/application/service/... -count=1 still has an unrelated existing failure in ./internal/application/service/file: TestOssEnsureBucket_CreateFails expects invalid OSS credentials to return an error.

[wolfkill]

Added local verification details for reviewers:

Additional local verification

• Started the dev dependency stack with docker compose --env-file .env.example -f docker-compose.dev.yml up -d postgres redis docreader. Verified Postgres and DocReader were healthy, and Redis responded with authenticated PONG.
• Started the backend locally against those dev dependencies and verified GET /health returned {"status":"ok"}. Startup logs showed DB migrations completed and DocReader connected successfully.
• Ran an HTTP AgentQA end-to-end regression with a temporary OpenAI-compatible fake LLM server. The second-turn prompt 它多少钱？ was rewritten before Agent execution; the downstream Agent LLM request contained the rewritten full query and did not contain the original pronoun-only query.
• Re-ran the same HTTP flow with the default rewrite prompt template to confirm placeholders were rendered correctly and no raw {{conversation}} / {{history}} placeholders leaked into the prompt.
• Ran a temporary official OpenAI-compatible model configuration through the same AgentQA flow and verified streaming tool-calling works end-to-end, including final_answer tool calls and non-empty streamed answers for both turns. Credentials were only used locally for this verification and were removed from the temporary model afterwards.

Test commands

• CGO_LDFLAGS="-lc++" go test ./internal/application/service/chat_pipeline -count=1
• CGO_LDFLAGS="-lc++" go test ./internal/application/service -count=1
• CGO_LDFLAGS="-lc++" go test ./internal/agent/... -count=1
• CGO_LDFLAGS="-lc++" go test ./internal/application/service/... -count=1 still hits the pre-existing unrelated ./internal/application/service/file OSS test failure (TestOssEnsureBucket_CreateFails), which is outside this PR diff.